Add Trustabl security scanning to CI

[joshua-trustabl]

I came across your repo and I like how it creatively combines Gemini's Google Search grounding with CrewAI to deliver humorous, context-aware GitHub roasts, especially the streaming FastAPI design that gives real-time feedback during the roast generation process. I scanned the repo, and noticed some agent runtime reliability findings that might be worth reviewing.

1. Add LlmAgent description
   In src/github_roaster/crew.py, the LlmAgent class inherits from crewAI's Agent but does not define a descriptive description field in its constructor. This impacts runtime behavior by preventing clear logging, debugging, or monitoring of agent-specific task routing and decision logic.

2. Configure agent safety_settings
   In src/github_roaster/crew.py, the Gemini LLM configuration lacks explicit safety_settings on the LlmAgent instantiation. This matters because without tailored safety configurations, the agent may produce inappropriate or inconsistent outputs during roasts, especially when querying diverse GitHub profiles.

3. Define agent tools in agent configuration
   In src/github_roaster/config/agents.yaml, agents are defined without explicit tools fields, even though the LlmAgent class is coded to support google_search. This means tool binding is implicit rather than declarative, reducing reliability and making it harder to audit or override tools per agent at runtime.

Recommendations are based on our understanding of agent runtime reliability, some findings may be intentional. Please let us know if this was intentional or if our findings are helpful so we can improve the accuracy of the scanner.

Best,
Trustabl.ai
Open-source AI agent reliability scanner (runs locally, GitHub Action)